PT-2022-15863 · WordPress · Student Result/Employee Database Wordpress Plugin

Krishna Harsha Kondaveeti + 1 · Published 2022-08-22 · Updated 2023-06-27 · CVE-2022-2312

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Student Result or Employee Database WordPress plugin versions prior to 1.7.5

Description The issue allows attackers to make logged-in users with a role as low as contributor to add, edit, and delete students via CSRF attacks due to the lack of CSRF in its AJAX actions. Furthermore, the lack of sanitization and escaping could also lead to Stored Cross-Site scripting.

Recommendations For versions prior to 1.7.5, update to version 1.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions to minimize the risk of exploitation. Additionally, restrict the role of contributors to prevent them from adding, editing, or deleting students until the issue is resolved.

Exploit

Fix

IDOR

CSRF

Weakness Enumeration

CWE-639

CWE-352

Related Identifiers

CVE-2022-2312

Affected Products

Student Result/Employee Database Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/7548c1fb-77b5-4290-a297-35820edfe0f8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2312 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2312 · Vendor Advisory
• https://t.me/cibsecurity/48475 · Telegram Post
• https://t.me/cvenotify/35120 · Telegram Post